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This article aims to identify common practices in Indonesian e- 
commerce regarding terms of use and privacy policies. Website visit 
rankings from Alexa and Similarweb were used to identify the 10 
most commonly visited e-commerce sites in Indonesia. Then, 
placement, length, and content structure of the terms of service and 
privacy policies of these websites were compared. Findings suggest 
that the information provided by these documents is sufficient and 
legally compliant, although some of the websites appear to disregard 
their importance. The actual contents of these documents were not 
analyzed and are thus open for further study. The information 
provided in this article may give merchants intending to open e- 
commerce stores in Indonesia some insight into how the protection of 
consumers’ personal data leads to better service. This paper also 
proposes a simple framework for assessing the extent to which an e- 
commerce website successfully ensures that consumers agree and 
consent to its terms of use without burdening them with lengthy and 
obscure legal documents. 





INTRODUCTION 


customers actually shifted to buying daily 
requirements online to save time while also taking 


Indonesia is projected to become the third largest 
e-commerce market in Asia by 2020 (Harsono, 
2016) . Both independent businesses and mass 
retailers are enjoying the growth of this market. 
Acknowledging this growth, the Indonesian 
government established the Electronic Information 
and Technology Law in 2008 to regulate it. 


At the beginning of the decade, the growth of e- 
commerce was slow due to low public trust 
regarding transaction security. Most e-commerce 
sites found that although they provided various 
payment methods, the majority of transactions were 
done through payment by bank transfer. However, 
due to the recent explosion in the ownership of 
smart phones, this gradually began to change. Some 


i Corresponding author. 
E-mail address: ab.gunawan @binus.ac.id 


advantage of slightly lower online prices including 
promotions and discounts. 


However, the increase in the number of e- 
commerce customers does not necessarily imply 
heightened internet literacy. While Internet fraud 
and crime rates related to e-commerce are difficult 
to obtain, news of such cases can become viral on 
social media. Consumers Union has identified 
several issues that customers must consider during 
browsing: (1) identity; (2) advertising and 
sponsorship; (3) customer service; (4) corrections; 
and (5) privacy (ConsumersUnion, 2016). 


Research has revealed that not many 
customers care about privacy on websites (Adams, 
2003). However, when privacy information is 
displayed prominently on a website, it may increase 
a customer’s willingness to buy from or trust that 
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website (Adams, 2003). Such privacy information is 
commonly included in a privacy policy. Notably, 
the absence of a privacy policy does not appear to 
discourage customers. The second piece of legal 
information is contained in the “terms of service,” 
also called “terms of use” or “disclaimer.” This 
information commonly conveys how a service 
provider expects a customer to use their website. 


Although consumer education is important 
in Indonesia, delivery channels are limited. 
According to the 2013 Curriculum, the former 
minister of education deleted ICT as a special 
subject, reflecting the opinion that consumer 
education is best obtained through the market itself. 
This research analyzes privacy policies and terms of 
use on Indonesian e-commerce websites with the 
goal of identifying the best practices available for 
Indonesian e-commerce websites and improving our 
understanding of how we can educate and motivate 
consumers to follow recommended protective 
measures (Tsai, Egelman, Cranor, & Acquisti, 
2011). 


THEORY 
Online Privacy 

Online privacy is the aspect of personal 
privacy that is related to communication over the 
Internet. It centers around the matter of obtaining, 
using, disclosing, and displaying personal data such 
as name, age, or behavior on a website. The concept 
of privacy involves space, decision, and 
information. In terms of space, individuals expect 
that their online rights will not be trespassed by 
others. In terms of decision, every individual 
expects to be able to determine the extent of 
personal space required. Some may freely disclose 
their birth date, for example, while others may not. 
In terms of information, privacy is meant to 
safeguard against the collection of information from 
various sources. 


With the rise of the Internet in the 1990s 
and mobile networks in the 2000s, online privacy 
has become a major concern. Most Internet users 
use commonly available tools to protect their basic 
privacy. However, some users prefer higher levels 
of privacy or even Internet anonymity. They may be 
particularly careful about what information they 
submit in online forms. 


A competition for personal data access is 
ongoing between the corporation and the individual. 
Corporations pay to learn about and understand 
individual preferences to direct targeted advertising 


while some individuals work hard to divulge 
minimum personal data to avoid being harvested by 
corporations. Although the corporations’ cause may 
be purely commercial, some parties use the same 
information for malicious acts such as spyware and 
malware. A major concern is Internet use by 
children and adolescents who do not particularly 
understand the risks involved in terms of their 
privacy. 


Indonesia does not have a specific law 
regarding protection of personal data; rather, the 
relevant laws are scattered among various acts such 
as Law No. 7 of 1971 concerning Main Provisions 
of Archives, Law No. 8 of 1997 concerning 
Company Documents, Law No. 7 of 1992 
concerning Banking as Amended by Law No. 10 of 
1998, Law No. 36 of 2009 concerning Health, Law 
No. 36 of 1999 concerning Telecommunications and 
Law No. 23 of 2006 concerning Population 
Administration. 


Law No. 11 of 2008 concerning Information 
and Electronic Transactions does not specifically 
regulate personal data but does contain some clauses 
that may be applied to cases of infringement. Article 
26 of this Law regulates the use of personal data in 
electronic media only by consent of the owners. 
Illegal access to systems that may contain personal 
data is regulated in Article 30. 


Government Regulations 82 of 2012, an 
implementing regulation for Law No. 11 of 2008, 
contains a minimal definition of personal data. 
Article 15 of the Act also regulates the 
responsibilities of providers to inform individuals in 
case of system failure, although no specific 
definition of failure is provided. 


Term of Use 

Terms of use, also known as terms of 
service, user agreements, or merely disclaimers, are 
commonly provided by content providers to regulate 
the use of their content by visiting users. A user is 
expected to abide by the set regulations when using 
the concerned website. Although various types of 
presentations are available, not all terms of use can 
be used effectively in court proceedings. 


Three general types of terms of use exist. 
The first is clickwrap, in which the user must click a 
button to signify agreement with the terms. This 
type is almost always defensible in court due to the 
agreement made by the user; it complies with the 
mutual assent principle of agreements in Indonesian 
law. However, there is a loophole as persons who 
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are of age and are capable have to consent to these 
agreements. This situation may be handled by 
inserting clauses that allow only persons of age to 
agree to the terms. 


The second type is browsewrap, in which 
users do not have to click on anything. Rather, the 
service provider presumes that users automatically 
agree to their terms when they browse the relevant 


website. Such an agreement is not always 
admissible in court due to the mutual assent 
principle. A link to the terms or the terms 


themselves must be displayed prominently on the 
home page or navigation bar at the point where the 
user commonly enters the site for the terms to be 
admissible in court. A famous case is that of Zappos 
(Milne, Rohm, & Bahl, 2004). 


The third and last type includes all other 
methods of displaying terms of use, none of which 
are admissible in court due to their incompatibility 
with agreement terms in Indonesian Civil Code. 


Terms of use are mostly critical in situations 
where in content use or misuse could be detrimental 
to the concerned service or to society in general. 
Since Act 11 of 2008, a content provider can be held 
responsible for the content hosted on their sites. 
This is dangerous especially for websites that 
display content provided by the users. It is not cost- 
effective to monitor all submissions to the system. A 
common alternative to this is providing complaint 
centers where a visiting user may report a page or an 
entire site if it infringes their interests, that is, 
copyright. The service provider may then retract the 
content for a certain amount of time, thus allowing 
dispute resolution to proceed. 


Privacy Policies 

A privacy policy is defined as a legal 
statement that discloses to clients how a service 
provider collects, stores, releases, and uses their 
personal data. Although exact contents may vary in 
different jurisdictions according to applicable laws 
and regulations, various general guidelines have 
been created. 

The Organization for Economic Co- 
operation and Development (OECD) held the 
Convention for the Protection of Individuals with 
regard to Automatic Processing of Personal Data 
(Convention 108) in 1981. This Convention 
provides guidelines for setting national regulations. 
Sweden, West Germany, France, and the United 
States created their own national laws in response. 
The OECD also issued the Recommendations of the 
Council Concerning Guidelines Governing the 


Protection of Privacy and Trans-Border Flows of 
Personal Data. The seven principles governing the 
recommendations were as follows: 


- Notice—data subjects should be given notice 
when their data is being collected; 


- Purpose—data should only be used for the 
purpose stated and not for any other purposes; 


- _Consent—data should not be disclosed without 
the data subject’s consent; 


- Security—collected data should be kept secure 
from any potential abuses; 


- Disclosure—data subjects should be informed 
as to who is collecting their data; 


- Access—data subjects should be allowed to 
access their data and make corrections to any 
inaccurate data; and 


- Accountability—data subjects should have a 
method available to them to hold data collectors 
accountable for not following the above 
principles. 


METHOD 

Data Collection 

We identified the top 10 ranked e-commerce 
websites in Indonesia from two free data providers, 
Alexa and SimilarWeb. The websites are listed in 
Table 1. 


Table 1: Indonesian e-commerce Website Rankings in 









































Alexa and SimilarWeb 
Alexa | SimilarWeb Website Type 
Rank* Rank** 
9 9 tokopedia.com marketplace 
13 18 bukalapak.com | marketplace 
17 11 lazada.co.id retail & 
marketplace 
21 19 elevenia.co.id retail & 
marketplace 
43 23 blibli.ccom retail & 
marketplace 
62 N/A*** alfacart.com retail & 
marketplace 
126 N/A*** blanja.com retail & 
marketplace 
130 N/A*** shopee.co.id retail & 
marketplace 
141 N/A*** bhinneka.com retail & 
marketplace 
172 N/A*** mataharimall.com | retail & 
marketplace 
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Data from Alexa was collected on November 14, 
2016 from http://www.alexa.com/topsites/countries/ 
ID 

Data from SimilarWeb was collected on November 
14, 2016 from _https://www.similarweb.com/top- 
websites/indonesia 

SimilarWeb free access only provides data on the top 
50 ranked sites. 


Data Analysis 

We obtained terms of use and privacy 
policy documents from these websites where 
applicable. If these documents were unavailable, we 
obtained similar documents having the same 
function. 

We analyzed the texts contained in the 
obtained documents. Sections are categorized and 
compared with other documents of the same type. 


Summarization 

Results of the data analysis are discussed 
and summarized. The data are compared to common 
best practices to measure compliance. We discuss 
three points, namely, (1) document availability; (2) 
whether the links to the documents are prominently 
displayed; and (3) document length. 


RESULTS AND DISCUSSION 
Data Analysis 
We obtained the terms of use and privacy 
policies from the same websites listed in Table 
1.These are listed in Table 2. 
Table 2: Term of Use and Privacy Policies on Indonesia 
e-commerce 


Ease of access and availability. 


Terms and conditions are statements that 
regulate how a visitor uses a site. Consequently, the 
link to these documents should be prominently 
displayed. Although all the above mentioned 
websites have such links on the homepage, all the 
links are located at the bottom of the webpage. Two 
sites, such as elevenia and alfacart, do not have 
separate privacy policies. Instead the privacy 
policies are incorporated into the terms and 
conditions. 


Six out of ten websites do not allow guest 
buyers (anonymous customers), and all these six 
require customers to agree to the terms and 
conditions by ticking a box during new customer 
registration. Although the remaining four websites 
allow one-time buying, bhinneka and lazada require 
customers to agree to the terms and 
conditions,whereas alfacart and shopee do not. Most 
consumers do not read any legal documents let 
alone lengthy ones (Subekti, 2014). Bhinneka.com 
has the shortest terms and conditions and privacy 
policy while lazada and shopee have the longest. 


Cookies and notifications. 

Three sites ask for the consumer’s permission 
to allow notifications. This is a nice feature as they 
do not automatically use cookies without consent. 


Data Scoring 

We scored each of the five variables from 1 to 
10 and then generated a combined score for each 
website. The highest score indicates the website that 
is most successfully geared toward privacy and yet 
does not confuse consumers with lengthy legal 
documents. The full score list is shown in Table 3. 












































No Website Location | Show | Guest | Terms ToU Privacy PP 
notif | buyer of Length Policy Length 
Use 

l tokopedia.com bortom: Yes No Yes 5624 Yes 1421 
middle 

5 bukalapak.com borton Yes Yes Yes 2981 Yes 182 
middle 

7 lazada.co.id Potion No Yes Yes 9642 Yes 1955 
middle 

j elevenia.co.id bottom- No No Yes 4879 ToU* N/A 
middle 

> | bliblicom bottom- | No | No | Yes | 3204| Yes 704 
middle 

6 alfacart.com a No No Yes 3614 ToU* N/A 

i blanja.com potom No No Yes 2838 Yes 2309 
middle 

8 shopee.co.id portoni Yes Yes Yes 7811 Yes 4876 

right 

? bhinneka.com bottom: No Yes Yes 1474 Yes 574 
middle 

E mataharimall.com bottom: No No Yes 6279 Yes 580 
middle 
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Table 3: Scoring of Indonesian Ecommerce Websites 


quality levels of websites when searching for 
health information. Proceedings: A Conference 





of the American Medical 



















































































PP ; a 
Sho - Informatics Association/. 
i Wih Gues ToU- Ww AMIA Annual Fall 
Site l notif | X1 | tbuy | X2 | ToU | X3 | WC X4 | PP C X5 | 2X Symposium. AMIA Fall 
tokopedia.co 14 á 
m Yes | 10 | No 5 | Yes | 10| 5624 | 44] Yes | 21 | 8.6 | 38 Symposium, 114. 
bukalapak.co Yes/ 18 37. | 2. ConsumersUnion. (2016). 
m Yes 10 | Yes 10 | But 1 2981 7 | Yes = 9.8 = Consumer Reports 
lazada.co.id | No 5| Yes | 10| Yes | 10 | 9642 | 04] Yes | 5| 8] 4 WebWatch Guidelines. 
elevenia.co.i ae 35. Retrieved November 8, 
d No 5 | No 5 | Yes 10 | 4879 | 5.1 | ToU ms 10 1 
0 36 2016, from 
blibli.com No 5 | No 5 | Yes | 10 | 3204 | 6.8 | Yes 4/93] 1 http://consumersunion.org 
i TETI 3 ; = /news/consumer-reports- 
* . g 
alfacart.com No 5 | No 5 | Yes 1 61 4 | ToU = 1 x webwatch-gui delines/ 
blanja.com No 5 | No 5 | Yes 10 | 2838 | 7.2 | Yes 09 |77| 9 | 3. Harsono, Hugh. (2016). 
Yes/ 48 28. Indonesia will be Asia’s 
shopee.co.id Yes 10 | Yes 10 | But 1 | 7811 | 2.2 | Yes 76 | 5.1 3 t bi t 
rikate a i next bigges e-commerce 
m No 5 | Yes 10 | Yes 10 | 1474 | 8.5 | Yes 4/94] 9 market. Retrived August, 
mataharimall. 58 33. 16, 2017. 
N 5|N 5 | Yes 10 | 6279 | 3.7 | Yes 0/94] 1 . 
com e e ss ss 4. Milne, George R., Rohm, 
Andrew J., & Bahl, Shalini. (2004). Consumers’ 
CONCLUSION , oe 


A simple analysis of Indonesian e-commerce 
websites indicated that bhinneka.com is the best e- 
commerce website in terms of privacy concerns. It 
allows guest buying in which the user does not have 
to store his or her data. Furthermore, it also takes 
precautions by forcing the user to accept their terms 
and conditions when buying from the website. 


Bhinneka.com also has the shortest terms and 
conditions and privacy policy, thus enabling 
consumers to read them in only a few minutes. 
While lengthy legal documents may seem 
necessary, the use of common language enables 
consumers to understand these documents easily. 


This paper introduces a simple framework for 
measuring the extent to which an e-commerce 
website successfully ensures that consumers agree 
and consent to its terms of use without burdening 
the consumer with lengthy and obscure legal 
documents. 
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